Hackers Exploit Critical PHP Flaws, US Warns of Broader Threats
WHO:
The Hacker News - Adel Karimi, detection and response lead at Perplexity, confirmed successful remote code execution against honeypot systems.
CNET - The article concerns hackers and people responsible for finding and patching vulnerabilities in internet infrastructure.
TechCrunch - The U.S. government cyber agency warned about the PHP vulnerabilities; hackers are exploiting them.
WHAT:
The Hacker News - CISA added two PHP flaws, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog; both are rated 9.2 on the CVSS scale and enable unauthenticated remote code execution.
The Hacker News - Karimi said the exploit response delivered an 800 KiB decoded cookie dump, and a function address derived from it appeared in a later execution payload.
The Hacker News - The PHP Foundation released Windows builds to address CVE-2026-111497, an out-of-bounds write in the Brotli decoder that could cause privilege escalation and unauthenticated remote code execution.
The Hacker News - More than 32.51 million PHP services were estimated to be running an affected version.
TechRadar - A remote code execution (RCE) flaw was found in Brotli, a Google-built open-source data compression algorithm.
TechRadar - A flaw dubbed “HTTP2Shell” prompted Microsoft and others to scramble to patch it; the article also reports a Node.js problem that may affect millions of sites.
CNET - The article describes a critical PHP warning as “the tip of the web vulnerability iceberg” and says AI is finding new holes in internet infrastructure.
TechCrunch - Hackers are exploiting critical bugs in PHP, software the article says is used in 70% of the web’s software.
WHY:
CNET - The article raises the question of whether people are available to patch vulnerabilities identified in internet infrastructure.
TechCrunch - The U.S. government cyber agency issued its warning because hackers had figured out how to exploit the PHP bugs.
HOW:
The Hacker News - The PHP flaws involve out-of-memory corruption and stale internal request state. Karimi said the demonstrated exploit chain used a single-worker mod_php profile and was not a measure of reliability on other configurations.
The Hacker News - In PHP Windows builds, the vulnerable Brotli decoder can be reached through cURL when automatic HTTP response decompression is enabled; cURL disables this by default.
CNET - The article says AI is finding new vulnerabilities in internet infrastructure.
TechCrunch - Hackers exploit the bugs in PHP; the article does not specify the exploit method.
(UPDATED October 27, 2026 22:10 UTC)
Hackers are exploiting two critical PHP vulnerabilities that allow unauthenticated remote code execution, prompting the U.S. cyber agency to add them to its Known Exploited Vulnerabilities catalog. Adel Karimi of Perplexity confirmed remote code execution on honeypot systems, and researchers estimated that more than 32.51 million PHP services run affected versions. Separately, the PHP Foundation released Windows builds to fix a flaw in the Brotli decoder that could enable privilege escalation or remote code execution when reached through cURL with automatic decompression enabled.
--
(UPDATED October 27, 2026 21:08 UTC)
Hackers are exploiting critical vulnerabilities in PHP, software used across much of the web, prompting a warning from a U.S. government cyber agency. Separately, a remote-code-execution flaw has been found in Google’s Brotli compression algorithm, while a vulnerability dubbed HTTP2Shell has led Microsoft and others to rush out patches. AI is also identifying new weaknesses in internet infrastructure, raising concerns about whether there are enough people available to fix them.
--
(UPDATED October 27, 2026 20:08 UTC)
Hackers are exploiting critical bugs in PHP, software used across 70% of the web, prompting a warning from the U.S. government’s cyber agency. The vulnerabilities highlight a broader concern: AI is finding new weaknesses in internet infrastructure. The challenge now is ensuring people can identify and patch those flaws.